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AMENDMENTS TO THE CLAIMS 



1 . (Currently Amended) A function randomness evaluating apparatus for a data 
encryption device comprising at l e ast one of : 

high e r ord e r diff e r e ntial cryptanalysis r e sistanc e e valuating m e ans for calculating tho 

minimum value of th e d e gree of a Boolean polynomial for input bits by which output bits of a 
function to be evaluat e d arc expr e ss e d, and e valuating that th e larger said minimum valu e , the 
higher tho r e sistance of said function to high e r ord e r differ e ntial cryptanalysis is; 

interpolation cryptanalysis resistanc e evaluating m e ans for: wh e n fixing a key y and 

l e tting x d e not e the input of a function to be evaluat e d, expr e ssing an output y by y ~ fk(x) using 
a polynomial over Galois fi e ld which is composed of elements equal to a prime p or a power of 
said prim e p; calculating the numb e r of terms of said polynomial; and evaluating th e r e sistanc e 
of said function to int e rpolation cryptanalysis bas e d on the result of said calculation; 

partitioning cryptanalysis resistance evaluating means for: dividing all inputs of a 

function to be evaluat e d and the corresponding outputs into input subsets and output subsets; 
calculating an imbalanc e of th e r e lationship betw ee n the subset of an input and th e subset of the 
corresponding output with resp e ct to their av e rage corresponding relationship; and evaluating tho 
r e sistance of said function to partitioning cryptanalysis based on th e result of said calculation; 

£1X1/3. 

UilU 

input means for inputting digital signals representing candidate functions S(x) of S-box to 

be evaluated, input difference value Ax and output mask values Tv, and storing them in storage 
means; 

differential-linear-cryptanalysis resistance evaluating means for: countin g calculating, for 
all sets of input difference value Ax and output mask value Ty o f each of the a-functions S(x)read 
out of the storage means to be evaluated , a the-number of inputs values x for which the inner 
product of (S(x)+S(x±Ax)) and said output mask value Ty is l^j-and evaluating the resistance of 
said function to differential-linear cryptanalysis based on the result o f said numbe r calculation ; 
and 

output means for outputting an output digital signal representing an evaluation result . 
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2. (Currently Amended) The function randomness evaluating apparatus of claim 1, 
wherein: 

said partitioning cryptanalysis r e sistance evaluating m e ans is m e ans for: dividing an 

input s e t F and an output set G of said function into u input subsets (F0, Fl , . . . , FFu 1 ) and v 
output subsets (GO, Gl, Gv 1) ; for each partition pair (Fi, Gi) (i - 0, u 1; j - 0, 1, v 
1), calculating the maximum on e of probabilities that all outputs y corresponding to all inputs x 
of the input subset Fi b e long to the respectiv e output subsets Gj (j ~ 0, . . v 1); calculating a 
measure IS(F, G) of an av e rage imbalanc e of a partition pair (F, G) based on all maximum 
values calculated for all partition pairs; and e valuating th e r e sistanc e of said function to said 
partitioning cryptanalysis bas e d on said m e asure; and 

said differential-linear cryptanalysis resistance evaluating means is means for: calculating 
the following equation for every set of said input difference value Ax except 0 and said output 
mask value Ty except 0 



calculating^ the-maximum value H among the calculation results; and evaluating the resistance 
of said function to said differential-linear cryptanalysis based on said maximum value E. 

3. (Currently Amended) The function randomness evaluating apparatus of claim 1 
or 2, further comprising at least one of: 

differential-cryptanalysis resistance evaluating means for calculating, for the a-function 
S(x) to be evaluated, the number of inputs values x that satisfy S(x)+_S(x4»S(x+ Ax)=Ay for every 
set (Ax, Ay) and evaluating the resistance of said function to differential cryptanalysis based on 
the result of said calculation; and 

linear-cryptanalysis resistance evaluating means for calculating, for the ^function to be 
evaluated, the number of inputs values x for which the inner product of the input value x and its 
mask value Tx is equal to the inner product of a function output value S(x) and its mask value Ty 
and evaluating the resistance of said function to linear cryptanalysis based on the result of said 
calculation. 



^ s (Ax, Ty) = 2x# {x e GF(2) n (S(x) + S(x + Ax)) • Ty = 1} - 2 



n 
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4. (Canceled). 

5. (Canceled). 

6. (Currently Amended) A random function generating apparatus for a data 
encryption device comprising: 

input means for inputting digital signals representing parameter values of each of a 

plurality of functions of different algeraic structures and storing them in storage means: 

candidate function generating means for generating candidate functions each formed by a 
combination o f said a-plurality of functions of different algebraic structures based on said and 
having a p lurality of parameters read out of the storage means : 

resistance evaluating means for evaluating the resistance of each of said candidate 
functions to a cryptanalysis; and 

selecting means for selecting those of said resistance-evaluated candidate functions which 
are have-highly resistant to said cryptanalysis and outputting digital signals representing selected 
ones of said resistance-evaluated candidate funcitons: 

wherein one of said plurality of functions of different algebraic structures is resistant to 

each of differential cryptanalysis and linear cryptanalysis . 

7. (Canceled). 

8. (Currently Amended) The random function generating apparatus of claim 6-ei^7, 
wherein said input means is adapted to input digital signals representing input difference values 
Ax and output mask values Tv and storing them in the storage means, and said resistance 
evaluating means comprises at least one of: 

higher-order-differential cryptanalysis resistance evaluating means for: calculating^ the 
minimum value of the degree of a Boolean polynomial for input bits by which output bits of each 
of said candidate functions are expressed; and evaluating the resistance of said each candidate 
function to higher order cryptanalysis based on the result of said calculation; 
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interpolation-cryptanalysis resistance evaluating means for: wh e n fixing a k e y y and 
l e tting x d e note the input of said e ach candidate, expressing an outpu t value y as hy-y = fk(x) for 
an input value x and a fixed key k using a polynomial over aj3alois field which is composed of 
elements equal to a prime p or a power of said prime p; counting calculating a&e-number of 
terms of said polynomial; and evaluating the resistance of said each candidate function to 
interpolation cryptanalysis based on the result of sai d numbe r calculation ; 

partitioning-cryptanalysis resistance evaluating means for: dividing all inputs input values 
ofthe arfunction to be evaluated and the corresponding output s values into input subsets and 
output subsets; calculating an imbalance ofthe relationships between the input subse t of an input 
and the output subset of tho corresponding output with respect to their average corresponding 
relationship; and evaluating the resistance of said function to partitioning cryptanalysis based on 
the result of said calculation; and 

differential-linear cryptanalysis resistance evaluating means for: calculating, for every set 
\ of input difference value Ax and output mask value Ty ofthe a-function S(x) to be evaluated,_a 
the-number of input s values x for which the inner product of (S(x)+S(x+Ax)) and said output 
mask value Ty is 1; and evaluating the resistance of said function to differential-linear 
cryptanalysis based on the result of said calculation. 



9. (Currently Amended) A method for evaluating the randomness of the 
input/output relationship of a functio n for data encryption , said method comprisin g at l e ast one 
ef: 

inputting digital signals representing candidate functions Sfx) of S-box to be evaluated. 

input difference values Ax and output mask values Tv, and storing them in storage means: 

(a) a higher order differential cryptanalysis r e sistance evaluating step of: l e tting said 

function b e r e present e d by S(x), calculating tho minimum valu e ofthe degr ee of a Boolean 
polynomial for input bits of said function S(x) by which its output bits ar e expr e ssed; and 
e valuating tho resistance of said function to higher order cryptanalysis bas e d on the result of said 
calculation; 

(b)-a differential-linear cryptanalysis resistance evaluating step of: counting calculating . 

for every set of input difference value Ax and output mask value Ty o f each ofthe a-functions 
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S (x) read out of the storage means- 




a the-number of inputs values x for which an 



the-inner product of (S(x)+S(x±Ax)) and said output mask value Ty is 1; and evaluating the 
resistance of said function to differential-linear cryptanalysis based on the result of said number 
calculation ; and 

outputting an output digital signal representing an evaluation result. 

(c) a partitioning cryptanalysis resistance e valuating st e p of: dividing all inputs of a 

function to be evaluat e d and th e corr e sponding outputs into input subsets and output subsets; 
calculating an imbalance of th e relationship b e tween the subset of an input and the subset of the 
corresponding output with r e sp e ct to th e ir average corr e sponding r e lationship; and e valuating the 
r e sistance of said function to partitioning cryptanalysis based on the r e sult of said calculation; 

111 Id 

(d) an interpolation cryptanalysis resistanc e e valuating step of: when fixing a key y and 

l e tting x d e note the input of said e ach candidate, expr e ssing an output y by y - flc(x) using a 
polynomial over Galois fi e ld which is compos e d of elements e qual to a prim e p or a power of 
said prime p; calculating th e number of terms of said polynomial; and evaluating the resistance 
of said function to interpolation cryptanalysis. 

10. (Currently Amended) The randomness evaluating method of claim 9, wherein: 
said differential-linear cryptanalysis resistance evaluating step (b)-is a step of:, l e tting th e 
input diff e rence and output mask value of said function S(x) b e repr e s e nting by Ax and Ty, 
r e sp e ctively, calculating the following equation for every set of said input difference value Ax 
except 0 and said output mask value Ty except 0 



calculating^ the-maximum value S among the calculation results; and evaluating the resistance 
of said function to said differential-linear cryptanalysis using said maximum value S.j-and 

said partitioning - cryptanalysis r e sistanc e evaluating st e p (c) is a step of: dividing an input 

set F and an output sot G of said function into u input subsets (F0, Fl, . . Fu - 1 } and v output 
subsets (GO, G 1 , . . . , Gv 1 ) ; for each partition pair (Fi, Gi) (i ~ 0, . . . , u 1 ; j - 0, 1 , . . . , v 1 ), 
calculating the maximum one of probabiliti e s that all outputs y corresponding to all inputs x of 



^ s (Ax,ry) = 2x#{x e GF(2) n (S(x) + S(x + Ax) • Ty = 1} - 2 



n 
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th e input subs e t Fi b e long to th e r e sp e ctiv e output subs e ts Gj (j - 0, . . . , v 1); calculating a 
m e asure IS(F, G) of an av e rag e imbalanc e of a partition pair (F, G) bas e d on all maximum 
valu e s calculat e d for all partition pairs; and e valuating th e r e sistanc e of said function to said 
partitioning cryptanalysis bas e d on said m e asur e . 



1 1 . (Currently Amended) The randomness evaluating method o f any one of claim 9^ 
e^lO, 35 or 36, further comprising at least one of: 

(de) a differential-cryptanalysis resistance evaluating step of: l e tting th e output difference 
value of said function S(x) bo roprosontcd by Ax, calculating the number of inputs values x that 
satisfy S(x)+_S{x+S(x+Ax)=Ay for every set (Ax, Ay) except Ax=0; and evaluating the resistance 
of said function to differential cryptanalysis based on the result of said calculation; and 

(ef) a linear-cryptanalysis resistance evaluating means for calculating, for said function 
S(x), the number of input s values x for which the inner product of the inpu t value x and its mask 
value Tx is equal to the inner product of a function output value S(x) and its mask value Ty and 
evaluating the resistance of said function to linear cryptanalysis based on the result of said 
calculation. 

12. (Canceled). 

13. (Currently Amended) A random function generating method for data encryption 
comprising the steps of: 

fo) inputting digital signals representing input difference values Ax, output mask values 

Tv and parameter values of each of a plurality of functions of different algebraic structures and 
storing them in storage means; 

(a) setting various input values read out of the storage means as e ach param e t e r fo r each 
of candidate functions S(x) of S-box and calculating output values corresponding to said various 
input values _x; 

(b) storing the output values r e sults of said calculation in storage means; and 
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(c) evaluating the resistance of each of said candidate functions to a cryptanalysis based 
on the output values stored in said storage means, and selectively outputting candidate function 
highly resistant to said cryptanalysis; and 

wherein said step (c) comprises comprising at l e ase one of : 

(c-1) a higher-order cryptanalysis resistance evaluating step of: calculating^ the 
minimum value of the degree of a Boolean polynomial for input bits of each of said candidate 
functions by which its output bits are expressed; evaluating the resistance of said each candidate 
function to higher order cryptanalysis based on the result of said calculation; and leaving those of 
said candidate functions whose resistance is higher than a predetermined first reference and 
discarding the others; 

(c-2) a differential-linear cryptanalysis resistance evaluating step of: calculating, for 
every set of input difference value Ax and output mask value Ty of each candidate function S(x), 
a-the number of input s values x for which the inner product of (S(x)+S(x±Ax)) and said output 
mask value Ty is 1 ; evaluating the-resistance of said function to differential-linear cryptanalysis 
based on the result of said calculation; and leaving those of said candidate functions whose 
resistance is higher than a predetermined second reference and discarding the others; 

(c-3) a partitioning-cryptanalysis resistance evaluating step of: dividing all input s values 
of each candidate function and the corresponding output s values into input subsets and output 
subsets; calculating an imbalance of the relationship between th e input subset of an input and the 
output subset of the corresponding output with respect to their average corresponding 
relationship; evaluating the resistance of said each candidate function to said partitioning 
cryptanalysis based on the result of said calculation; and leaving those of said candidate 
functions whose resistance is higher than a predetermined third reference and discarding the 
others; and 

(c-4) an interpolation-cryptanalysis resistance evaluating step of: when fixing a k e y y and 
l e tting x d e note the input of said e ach candidat e , expressing an outpu t value y as by-y = fkfx) for 
an input value x and a fixed key k using a polynomial over a_Galois field which is composed of 
elements equal to a prime p or a power of said prime p; counting calculating athe-number of 
terms of said polynomial; evaluating the resistance of said function to interpolation 
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cryptanalysis; and leaving those of said candidate functions whose resistance is higher than a 
predetermined fourth reference and discarding the others. 

1 4. (Currently Amended) The random function generatin g method apparatus of claim 
13, wherein: 

said differential-linear-cryptanalysis resistance evaluating step (c-2) includes a step of: 
letting the output mask valu e bo r e pr e s e nted by Ty, calculating the following equation for every 
set of said input difference value Ax except 0 and said output mask value Ty except 0 

^ s (Ax,r y ) = 2x# {x e GF(2) n |(S(x) + S(x + Ax)) • Ty = 1} - 2 n 

9 

calculating_a fee-maximum value S among the calculation results; and evaluating the resistance 
of said candidate function to said differential-linear cryptanalysis based on sai d maximum value 
3; and 

said parti tioning_Ocryptanalysis resistance evaluating step (3) includes a step of dividing 
an input value set F and an outpu t value set G of said function into u input subsets {F0, FI, . . ., 
FFu-1} andvoutput subsets {G0 5 G1, Gv-1}; for each partition-pair (Fi, Gi) (i = 0, ...,u-l;j 
= 0, 1, .. ., v-1), calculating^ fee-maximum one of probabilities that all output s values y 
corresponding to all inputs values x of the input subset Fi belong to the respective output subsets 
Gj G = 0> •••> v-1); calculating a measure IS(F, G) of an average imbalance of a partition-pair (F, 
G) based on all maximum values calculated for all partition pairs; and evaluating the resistance 
of said candidate function to said partitioning cryptanalysis based on said measure. 

15. (Original) The random function generating method of claim 13 or 14, wherein: 
said step (c-1) includes a step of: when no candidate function remains undiscarded, 

easing the candidate function selecting condition by changing said first reference by a first 
predetermined width, and executing again the evaluation and selecting process; 

said step (c-2) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said second reference by a second 
predetermined width, and executing again the evaluation and selecting process; 
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said step (c-3) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said third reference by a third 
predetermined width, and executing again the evaluation and selecting process; and 

said step (c-4) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said fourth reference by a fourth 
predetermined width, and executing again the evaluation and selecting process. 

16. (Currently Amended) The random function generating method of claim 13 or 14, 
further comprisin g at l e ast one of : 

(c-5) a differential-cryptanalysis resistance evaluating step of: calculating, for each 
candidate function S(x), the number of inputs x that satisfy S(x)+_S(x4*S(x+Ax)=Ay for every set 
(Ax, Ay) except Ax^O; evaluating the resistance of said each candidate function to differential 
cryptanalysis based on the result of said calculation; and leaving those of said candidate 
functions whose resistance is higher than a predetermined fifth reference and discarding the 
others before said step (c-2) : and 

(c-6) a linear-cryptanalysis resistance evaluating step of: calculating, for each candidate 
function, the number of inputs values x for which the inner product of the inpu t value x and its 
mask value Tx is equal to the inner product of a function output value S(x) and its mask value 
Ty; evaluating the resistance of said each candidate function to linear cryptanalysis based on the 
result of said calculation; and leaving those of said candidate functions whose resistance is 
higher than a predetermined sixth reference and discarding the others after said step (c-5) . 

17. (Canceled). 

18. (Currently Amended) The random function generating method of claim 16 or 17 , 
wherein: 

said step (c-5) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said fifth reference by a fifth 
predetermined width, and executing again the evaluation and selecting process; and 
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said step (c-6) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said sixth reference by a sixth 
predetermined width, and executing again the evaluation and selecting process. 

19. (Previously Presented) The random function generating method of claim 14, 
wherein said candidate functions are each a composite function composed of at least one 
function resistant to said differential cryptanalysis and said linear cryptanalysis and at least one 
function of an algebraic structure different from that of said at least one function. 

20. (Currently Amended) A recording medium having recorded thereon a random 
function generating method for data encryption as a computer program, said program comprising 
the steps of: 

(a) setting various values as each parameter for candidate functions S(x) and calculating 
output values corresponding to various input values; 

(b) storing the output values r e sults of said calculation in storage means; and 

(c) evaluating the-resistance of each of said candidate functions to a cryptanalysis based 
on the output values stored in said storage means, and selectively outputting candidate function 
highly resistant to said cryptanalysis; and 

wherein said step (c) comprises comprising at loaso ono of : 
(c-1) a higher-order cryptanalysis resistance evaluating step of: calculating^ the 
minimum value of the degree of a Boolean polynomial for input bits of each of said candidate 
functions by which its output bits are expressed; evaluating the resistance of said each candidate 
function to higher order cryptanalysis based on the result of said calculation; and leaving those of 
said candidate functions whose resistance is higher than a predetermined first reference and 
discarding the others; 

(c-2) a differential-linear cryptanalysis resistance evaluating step of: calculating, for 
every set of input difference value Ax and output mask value Ty of each candidate function S(x), 
a the-number of inputs values x for which the inner product of (S(x)+S(x+Ax)) and said output 
mask value Ty is 1 ; evaluating the-resistance of said function to differential-linear cryptanalysis 
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based on the result of said calculation; and leaving those of said candidate functions whose 
resistance is higher than a predetermined second reference and discarding the others; 

(c-3) a partitioning-cryptanalysis resistance evaluating step of: dividing all input s values 
of each candidate function and the corresponding outputs values into input subsets and output 
subsets; calculating an imbalance of the relationship between the input subset of an input and the 
output subset of th e corr e sponding output with respect to their average corresponding 
relationship; evaluating the resistance of said each candidate function to said partitioning 
cryptanalysis based on the result of said calculation; and leaving those of said candidate 
functions whose resistance is higher than a predetermined third reference and discarding the 
others; and 

(c-4) an interpolation-cryptanalysis resistance evaluating step of: wh e n fixing a key y and 
l e tting x d e not e the input of said e ach candidate, expressing an output value v as b^y = fk(x) for 
an input value x and a fixed key k using a polynomial over a_Galois field which is composed of 
elements equal to a prime p or a power of said prime p; counting a calculating th e number of 
terms of said polynomial; evaluating the resistance of said function to interpolation 
cryptanalysis; and leaving those of said candidate functions whose resistance is higher than a 
predetermined fourth reference and discarding the others. 



21 . (Currently Amended) The recording medium of claim 20, wherein: 
said differential-linear-cryptanalysis resistance evaluating step (c-2) includes a step of: 
l e tting the output mask valu e be represent e d by Ty, calculating the following equation for every 
set of said input difference Ax except 0 and said output mask value Ty except 0 

^ s (Ax, ry) = 2x# {x g GF(2) n (S(x) + S(x + Ax)) • Ty = 1} - 2 n 

calculating^ the-maximum value H among the calculation results; and evaluating the resistance 
of said candidate function to said differential-linear cryptanalysis based on sai d maximum value 
S; and 

said partitioning_Ocryptanalysis resistance evaluating step (3) includes a step of dividing 
an input value set F and an outpu t value set G of said function into u input subsets {F0, Fl , . . . , 
FFu-1} and v output subsets {GO, Gl, Gv-1}; for each partition-pair (Fi, Gi) (i = 0, u-1; j 
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= 0, 1, . . v-1), calculating a the-maximum one of probabilities that all outputs values y 
corresponding to all input s values x of the input subset Fi belong to the respective output subsets 
Qj (j = 0, ., v-1); calculating a measure IS(F, G) of an average imbalance of a partition-pair (F, 
G) based on all maximum values calculated for all partition pairs; and evaluating the resistance 
of said candidate function to said partitioning cryptanalysis based on said measure. 

22. (Original) The recording medium of claim 20 or 2 1 , wherein: 

said step (c-1) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said first reference by a first 
predetermined width, and executing again the evaluation and selecting process; 

said step (c-2) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said second reference by a second 
predetermined width, and executing again the evaluation and selecting process; 

said step (c-3) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said third reference by a third 
predetermined width, and executing again the evaluation and selecting process; and 

said step (c-4) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said fourth reference by a fourth 
predetermined width, and executing again the evaluation and selecting process. 

23. (Currently Amended) The recording medium of claim 20 or 21, wherein said 
program includ e sat includes at least one of: 

(c-5) a differential-cryptanalysis resistance evaluating step of: calculating, for each 
candidate function S(x), the number of inputs x that satisfy S(x)+_S(x4*S(x+Ax)=Ay for every set 
(Ax, Ay) except Ax^O; evaluating the resistance of said each candidate function to differential 
cryptanalysis based on the result of said calculation; and leaving those of said candidate 
functions whose resistance is higher than a predetermined fifth reference and discarding the 
others before said step (c-2) : and 

(c-6) a linear-cryptanalysis resistance evaluating step of: calculating, for each candidate 
function, the number of input s values x for which the inner product of the input value x and its 
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mask value Fx is equal to the inner product of a function output value S(x) and its mask value 
Ty; evaluating the resistance of said each candidate function to linear cryptanalysis based on the 
result of said calculation; and leaving those of said candidate functions whose resistance is 
higher than a predetermined sixth reference and discarding the others after step (c-5) . 

24. (Canceled). 

25. (Currently Amended) The recording medium of claim 23 or 2 4, wherein: 
said step (c-5) includes a step of: when no candidate function remains undiscarded, 

easing the candidate function selecting condition by changing said fifth reference by a fifth 
predetermined width, and executing again the evaluation and selecting process; and 

said step (c-6) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said sixth reference by a sixth 
predetermined width, and executing again the evaluation and selecting process. 

26. (Previously Presented) The recording medium of claim 21, wherein said 
candidate functions are each a composite function composed of at least one function resistant to 
said differential cryptanalysis and said linear cryptanalysis and at least one function of an 
algebraic structure different from that of said at least one function. 

27. (Currently Amended) A recording medium having recorded thereon as a program 
a method for evaluating the randomness of the input/output relationship of a function for data 
encryption , said program comprisin g at least one of : 

(a) a higher order - diff e r e ntial cryptanalysis r e sistance evaluating stop of: letting said 

function be represented by S(x), calculating the minimum valu e of the dogroo of a Boolean 
polynomial for input bits of said function S(x) by which its output bits ar e e xpr e ssed; and 
e valuating th e r e sistanc e of said function to higher order cryptanalysis based on the r e sult of said 
calculation; 

(ab) a differential-linear cryptanalysis resistance evaluating step of: calculating, for every 
set of input difference value Ax and output mask value Ty of a function S(x) to be evaluated,_a 
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the-number of input s values x for which the inner product of (S(x)+S(x±Ax)) and said output 
mask value Ty is 1; and evaluating the-resistance of said function to differential-linear 
cryptanalysis based on the result of said calculation^ 

(c) a partitioning cryptanalysis resistanc e evaluating st e p of: dividing all inputs of a 

function to b e e valuat e d and th e corresponding outputs into input subs e ts and output subs e ts; 
calculating an imbalance of the relationship between th e subset of an input and the subset of the 
corresponding output with resp e ct to their average corr e sponding relationship; and e valuating the 
r e sistance of said function to partitioning cryptanalysis based on the result of said calculation; 

til 111 

(d) an interpolation cryptanalysis resistanc e e valuating step of: wh e n fixing a key y and 

l e tting x denote the input of said each candidate, expr e ssing an output y by y ~ flc(x) using a 
polynomial over Galois field which is composed of e lements equal to a prime p or a pow e r of 
said prime p; calculating the numb e r of terms of said polynomial; and evaluating th e r e sistance 
of said function to interpolation cryptanalysis. 



28. (Currently Amended) The recording medium of claim 27, wherein: 
said differential-linear cryptanalysis resistance evaluating step (ab) is a step of: l e tting the 
input diff e r e nce and output mask value of said function S(x) b e r e presenting by Ax and Ty, 
r e spectively, calculating the following equation for every set of said input differenc e value Ax 
except 0 and said output mask value Ty except 0 

^ s (Ax,ry) = 2x# {x e GF(2) n (S(x) + S(x + Ax) • Ty = 1} - 2 n 

9 

calculating_a the-maximum value S among the calculation results; and evaluating the resistance 

of said function to said differential-linear cryptanalysis using said maximum value H.^-aftd 

said partitioning cryptanalysis resistance evaluating st e p (c) is a step of: dividing an input 

s e t F and an output s e t G of said function into u input subsets (F0, Fl , . . . , Fu 1 } and v output 

subsets (GO, Gl , . . . , Gv 1 ) ; for each partition pair (Fi, Gi) (i ~ 0, . . . , u 1 ; j - 0, 1 , . . . , v 1 ), 

calculating the maximum one of probabiliti e s that all outputs y corresponding to all inputs x of 

the input subs e t Fi b e long to the respectiv e output subs e ts Gj (j ~ 0, . . ., v 1); calculating a 

m e asur e IS(F, G) of an averag e imbalanc e of a partition - pair (F, G) based on all maximum 

16 




Application No.: 09/463,907 Docket No.: 20162-00547-US 

valu e s calculat e d for all partition pairs; and e valuating the resistanc e of said function to said 
partitioning cryptanalysis bas e d on said m e asur e . 

29. (Currently Amended) The recording medium of claim 27 or 28, said program 
further comprising at least one of: 

(e) a differential-cryptanalysis resistance evaluating step of: l e tting the output difference 
valu e of said function S(x) bo represented by Ax, calculating^ the-number of input s values x that 
satisfy S(x)+_S(x±S(x+Ax)=Ay for every set (Ax, Ay) except Ax=0; and evaluating the resistance 
of said function to differential cryptanalysis based on the result of said calculation; and 

(f) a linear-cryptanalysis resistance evaluating means for calculating, for said function 
S(x), the number of inputs values x for which the inner product of the inpu t value x and its mask 
value Tx is equal to the inner product of a function output value S(x) and its mask value Ty and 
evaluating the resistance of said function to linear cryptanalysis based on the result of said 
calculation. 

30. (Canceled). 

3 1 . (Previously Presented) The random function generating method of claim 15, 
wherein said candidate functions are each a composite function composed of at least one 
function resistant to said differential cryptanalysis and said linear cryptanalysis and at least one 
function of an algebraic structure different from that of said at least one function. 

32. (Previously Presented) The recording medium of claim 22, wherein said 
candidate functions are each a composite function composed of at least one function resistant to 
said differential cryptanalysis and said linear cryptanalysis and at least one function of an 
algebraic structure different from that of said at least one function. 

33. (New) The function randomness evaluating apparatus of claim 1 or 2, further 
comprising at least one of: 



17 




Application No.: 09/463,907 Docket No.: 20162-00547-US 

higher-order-differential cryptanalysis resistance evaluating means for calculating a 
minimum value of the degree of a Boolean polynomial for input bits by which output bits of the 
function to be evaluated are expressed, and evaluating that larger said minimum value, higher 
the resistance of said function to higher order differential cryptanalysis is; 

interpolation-cryptanalysis resistance evaluating means for: expressing an output value y 
as y = fk(x) for an input value x and a fixed key k using a polynomial over a Galois field which 
is composed of elements equal to a prime p or a power of said prime p; counting a number of 
terms of said polynomial; and evaluating the resistance of said function to interpolation 
cryptanalysis based on the result of said number; and 

partitioning-cryptanalysis resistance evaluating means for: dividing all input values of the 
function to be evaluated and the corresponding output values into input subsets and output 
subsets; calculating an imbalance of the relationship between the input subset and the output 
subset with respect to their average corresponding relationship; and evaluating the resistance of 
said function to partitioning cryptanalysis based on the result of said calculation. 

34. (New) The function randomness evaluating apparatus of claim 33, wherein: 
said partitioning-cryptanalysis resistance evaluating means is means for: dividing an 

input value set F and an output value set G of said function into u input subsets {F0, Fl, . , Fu- 
1 } and v output subsets {GO, Gl , . . . , Gv-1 } ; for each partition-pair (Fi, Gi) (i = 0, . . . , u-1 ; j = 0, 
1, . . v-1), calculating a maximum one of probabilities that all output value y corresponding to 
all input values x of the input subset Fi belong to the respective output subsets Gj (j = 0, .. ., v-1); 
calculating a measure IS(F, G) of an average imbalance of a partition-pair (F, G) based on all 
maximum values calculated for all partition pairs; and evaluating the resistance of said function 
to said partitioning cryptanalysis based on said measure. 

35. (New) The randomness evaluating method of claim 9 or 10, further comprising at 
least one of: 

(a) a higher-order-differential cryptanalysis resistance evaluating step of: calculating a 
minimum value of the degree of a Boolean polynomial for input bits of said function S(x) by 
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which its output bits are expressed; and evaluating the resistance of said function to higher order 
cryptanalysis based on the result of said calculation; 

(b) a partitioning-cryptanalysis resistance evaluating step of: dividing all input values of 
the function to be evaluated and the corresponding output values into input subsets and output 
subsets; calculating an imbalance of the relationship between the input subset and the output 
subset with respect to their average corresponding relationships; and evaluating the resistance of 
said function to partitioning cryptanalysis based on the result of said calculation; and 

(c) an interpolation-cryptanalysis resistance evaluating step of: expressing an output 
value y as y = fk(x) for an input value x and a fixed key k using a polynomial over a Galois field 
which is composed of elements equal to a prime p or a power of said prime p; counting a number 
of terms of said polynomial; and evaluating the resistance of said function to interpolation 
cryptanalysis. 

36. (New) The randomness evaluating method of claim 35, wherein: 

said partitioning-cryptanalysis resistance evaluating step (b) is a step of: dividing an input 
value set F and an output value set G of said function into u input subsets {F0, FI, Fu-1} and 
v output subsets {GO, Gl , . . . , Gv- 1 } ; for each partition-pair (Fi, Gi) (i = 0, . . . , u- 1 ; j = 0, 1 , . . . , 
v-1), calculating a maximum one of probabilities that all output values y corresponding to all 
input values x of the input subset Fi belong to the respective output subsets Gj (j = 0, . . ., v-1); 
calculating a measure IS(F, G) of an average imbalance of a partition-pair (F, G) based on all 
maximum values calculated for all partition pairs; and evaluating the resistance of said function 
to said partitioning cryptanalysis based on said measure. 

37. (New) The recording medium of claim 27 or 28, further comprising at least one 

of: 

(b) a higher-order-differential cryptanalysis resistance evaluating step of: calculating a 
minimum value of the degree of a Boolean polynomial for input bits of said function S(x) by 
which its output bits are expressed; and evaluating the resistance of said function to higher order 
cryptanalysis based on the result of said calculation; 
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(c) a partitioning-cryptanalysis resistance evaluating step of: dividing all input values of 
the function to be evaluated and the corresponding outputs into input subsets and output subsets; 
calculating an imbalance of the relationships between the input subset and the output subset with 
respect to their average corresponding relationship; and evaluating the resistance of said function 
to partitioning cryptanalysis based on the result of said calculation; and 

(d) an interpolation-cryptanalysis resistance evaluating step of: expressing an output 
value y as y = fk(x) for an input value x and a fixed key k using a polynomial over a Galois field 
which is composed of elements equal to a prime p or a power of said prime p; counting a number 
of terms of said polynomial; and evaluating the resistance of said function to interpolation 



38. (New) The recording medium of claim 37, wherein: 

said partitioning-cryptanalysis resistance evaluating step (c) is a step of: dividing an input 
value set F and an output value set G of said function into u input subsets {F0, FI , . . . , Fu-1 } and 
v output subsets {GO, Gl, Gv-1}; for each partition-pair (Fi, Gi) (i = 0, ...,u-l; j =0, 1, 
v-1), calculating a maximum one of probabilities that all output values y corresponding to all 
input values x of the input subset Fi belong to the respective output subsets Gj (j j = 0, . . ., v-1), 
calculating a measure IS(F, G) of an average imbalance of a partition-pair (F, G) based on all 
maximum values calculated for all partition pairs; and evaluating the resistance of said function 
to said partitioning cryptanalysis based on said measure. 




cryptanalysis. 



